test(launchpack): restore runtime trust-boundary coverage

[joeykchen]

Summary

• restore driver-independent launchpack coverage split from feat(xgodriver): implement SPX project-driver source mode #1753
• verify local manifests and assets fail closed without network fallback
• verify pinned published manifests, archive digests, offline caches, repair, and local release directories

Verification

• go test ./...
• go test -race ./internal/launchpack
• go vet ./internal/launchpack
• git diff --check

[fennoai]

The added local and published runtime tests cover manifest selection, digest validation, offline cache behavior, repair, retry, and local release directories. The changed test units pass under go test ./internal/launchpack, go test -race ./internal/launchpack, go vet ./internal/launchpack, and git diff --check. The repository-wide go test ./... run still has an unrelated failure in internal/projectpolicy/TestPortableConfigSnapshotRejectsIdentityAndContentDrift; that package is outside this PR’s two changed files.